Log in Start free

Vulnerability · Published Jun 9, 2021 · Assigned by eclipse

CVE-2021-28169

Medium 5.3

In plain English

A medium-severity information exposure in Eclipse Jetty from The Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 78.5% (higher than 99.6% of all known vulnerabilities). Ready-made attack tooling exists: Nuclei. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)78.5%top 0.4% of all CVEs
Exploited in the wildNo reportsnot in CISA KEV
Attack tooling1Nuclei

Official description

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12jetty99.4.39-2DEBIAN-CVE-2021-28169
Debian:13jetty99.4.39-2DEBIAN-CVE-2021-28169
Debian:14jetty99.4.39-2DEBIAN-CVE-2021-28169
Mavenorg.eclipse.jetty:jetty-servlets9.4.41GHSA-gwcr-j4wh-j3cq
Mavenorg.eclipse.jetty:jetty-servlets10.0.3GHSA-gwcr-j4wh-j3cq
Mavenorg.eclipse.jetty:jetty-servlets11.0.3GHSA-gwcr-j4wh-j3cq

Affected products (as reported)

VendorProductVersions
The Eclipse Foundation Eclipse Jetty unspecified – through 9.4.40unspecified – through 10.0.2unspecified – through 11.0.2

Weakness: CWE-200 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

References